CVE-2024-23637: OctoPrint Unverified Password Change via Access Control Settings

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-31 · updated 2026-06-17
Weakness: CWE-287

Description

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

Affected products

OctoPrint: through 1.9.3

References

https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125
https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1
https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr
https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125
https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1
https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr

Get alerted when CVE-2024-23637 or the next vulnerability affects your stack